Question

spark版本：v2.4.0
eks信息：v1.10.11-eks

提交后，收到以下错误消息：

019-02-21 15:08:44警告WatchConnectionManager：185-执行失败：HTTP 403，状态：403-禁止播客：用户“ system：anonymous”无法观看命名空间“ spark”中的播客   java.net.ProtocolException：预期的HTTP 101响应，但被禁止为“ 403”

线程“ main”中的异常io.fabric8.kubernetes.client.KubernetesClientException：禁止使用pods：用户“ system：anonymous”无法监视命名空间“ spark”中的pods

Answer 1

您需要为system：anonymous用户创建Role才能观看您的命名空间中的Pod，类似于下面的yaml

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: spark # your namespace
  name: pod-reader # Role name will be needed for binding to user
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

然后，您需要创建RoleBindging将此角色绑定到与以下yaml相似的 system：anonymous 用户

# This role binding allows "system:anonymous" to read pods in the "spark" namespace.
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: spark # your namespace
subjects:
- kind: User
  name: system:anonymous # Name is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role #this must be Role or ClusterRole
  name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io

Documentation了解有关匿名请求的更多信息

执行失败：在k8s上提交spark时，HTTP 403

1 个答案: